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DETAILED ACTION 

Response to Arguments 

1. Applicant's arguments, filed 7/30/2008, relating to pages 14, 15, and 17 - 28 have 
been fully considered. Applicant argues on said pages that "none of Shipp, Devine, Milliken, 
Anderson, Uuencode, Gordon and Sahami, taken alone or in combination, discloses, teaches 
or suggests a "method comprising . . . sorting the generated tokens in accordance with the 
corresponding determined spam probability value". Applicant relates this argument to the 
claims noted above. Applicant's argument is persuasive, but moot in view of the new 
grounds of rejection, which are further detailed below. 

2. The remainder of Applicant's arguments have been fully considered but they are not 
persuasive. 

3. Applicant's arguments on page 12, consist Applicant repeating arguments that 
Applicant states have already been presented and argued. These arguments, on pages 12 - 
13, are unpersuasive for the reasons given in the prior office actions. 

4. Applicant's arguments on pages 12 and 13 specifically argues Shipp, arguing that 
"Shipp teaches away from tokenizing the attachment by specifically choosing not to log such 
emails as spam." This argument, as noted above, is unpersuasive for the reasons given in 
the prior office action. Paragraph 81 of Shipp states: 

If mail contains attachments, do not log (spam mail currently does not contain 
attachments). (Emphasis added) 

Shipp thus does not teach away from considering that spam email may contain 
attachments. Shipp notes, through the use of the word "currently", that spam email does 
not contain attachments, but also anticipates that spam emails not containing attachments 
may change in the future. Milliken, the reference cited to teach processing email 
attachments in relation to spam email, was filed more than a full year after Shipp. Milliken 
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clearly views the situation regarding spam emails containing attachments to have changed. 
Shipp, by specifically limiting their assertion that spam emails do not contain attachments to 
the current state in 2002, clearly does not teach away from a future consideration of spam 
email containing attachments at some other point in time. 

Applicant's argument thus is not persuasive. Furthermore, Applicant's present 
argument fails to address the Milliken reference; In response to applicant's arguments 
against the references individually, one cannot show nonobviousness by attacking 
references individually where the rejections are based on combinations of references. See 
In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986). 

5. Applicant continues on pages 13 and 14, repeating the claim language of claim 1. 
Applicant's arguments fail to comply with 37 CFR 1.111(b) because they amount to a 
general allegation that the claims define a patentable invention without specifically pointing 
out how the language of the claims patentably distinguishes them from the references. 

6. Applicant continues on page 16, noting that they are repeating a previously 
presented and addressed argument, reiterates the argument that "Gordon fails to even 
suggest 'determining a probability value for each of the generated tokens." To support this 
argument, Applicant had stated that 

"determining a probability associated with words in an email is completely different 
than performing actions to tokenize an attachment" 

The Examiner thus noted that it was never the position of The Office that 
"determining a probability associated with words" was the same as "performing actions to 
tokenize an attachment". 

Applicant now elaborates on their argument against the applicability of Gordon, 
arguing that "Gordon only teaches determining a probability of words or groups of words. 
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Nowhere does Gordon even suggest 'determining a probability value for each of the 
generated tokens". However, Gordon does clearly teach determining a probability value for 
each of a generated token (col. 11 lines 15 - 32). In one embodiment disclosed by Gordon, 
said tokens may be represented by words or groups of words. The claim, however, was 
rejected under 35 USC 103, Shipp in view of Devine, Milliken, Anderson, Uuencode and 
MIME FAQ, Gordon and further in view of Sahami. That Gordon teaches one embodiment 
where tokens may correspond to "words or groups of words" does not prohibit the citation 
as a whole from teaching where tokens represent other items as well, such as the result of 
"tokenizing the text body", "tokenizing the SMTP email address", "tokenizing the domain 
name" and "tokenizing the attachment". Said claimed subject matter was taught using the 
other cited references. As noted above, the rejection was made under 35 USC 103; In 
response to applicant's arguments against the references individually, one cannot show 
nonobviousness by attacking references individually where the rejections are based on 
combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In 
re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). Applicant's arguments 
against Gordon are thus not persuasive. 

7. Applicant next argues that the arguments relating to Gordon were neglected and not 
addressed "in any detail" and thus that "the Office Action fail[ed] to provide a proper 
rejection." Applicant's argument is not persuasive, as the Applicant's argument relating to 
Gordon had been fully addressed since the support for said argument was fully addressed, 
as was discussed above. 

8. Applicant's arguments relating to the newly added subject matter, as noted above, 
are thus persuasive but moot in view of the new grounds of rejection made below. 
Applicant's arguments otherwise are unpersuasive, for the reasons given above. 
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Claim Rejections - 35 USC §103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a 
whole would have been obvious at the time the invention was made to a person having 
ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

5. Claims 1 and 39 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Shipp (US 2004/0093384 Al) in view of Devine et al. (US 6,968,571 B2), hereafter Devine, 
further in view of Milliken et al. (US 2004/0073617 Al), hereafter Milliken, further in view of 
Anderson et al. (US 2004/0064537 Al), hereafter Anderson, further in view of Uuencode 
and MIME FAQ 

(http://web.archive.Org/web/20021217052047/http://users.rcn.com/wussery/attach.html), 
further in view of Gordon et al. (US 6,732,157 Bl), hereafter Gordon, further in view of 
Sahami et al. (A Bayesian Approach to Filtering Junk E-Mail), hereafter Sahami, further in 
view of Woitaszek and Shaaban (Identifying Junk Electronic Mail in Microsoft Outlook with a 
Support Vector Machine), hereafter Woitaszek. 

6. Regarding claim 1, Shipp shows a method comprising 

receiving an email message from a simple mail transfer protocol (SMTP) server, the 
email message comprising ([0018,0023]) 
a text body ([0064,0065]) 

an SMTP email address ([0018,0023,0039,0045,0046]) 

a domain name corresponding to the SMTP email address ([0039,0045,0046]) 
an attachment ([0081]) 

tokenizing the text body to generate tokens representative of words in the text 
([0064-0067]) 
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tokenizing the SMTP email address to generate a token representative of the SMTP 
email address ([0039,0043,0069]) 

tokenizing the domain name to generate a token that is representative domain name 
([0022]) 

as well as showing MD5 hashing ([0093]). 

Shipp does not show a 32-bit string indicative of the length of the email message, 
nor does Shipp show tokenizing the attachment and the steps comprising tokenizing said 
attachment, determining a probability value for each generated token, selecting a 
predefined number of interesting tokens, the interesting tokens being the generated tokens 
having the greatest non-neutral probability value; performing a Bayesian analysis on the 
selected interesting tokens to generate a spam probability; and categorizing the email 
message as a function of the generated spam probability. 

Devine shows utilizing a 32-bit string in a message header which is indicative of the 
total length of said message (col. 24 lines 52-67). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp with that of Devine in order to better identify 
message contents so as to facilitate leveraging common code for processing messages 
(Devine col. 23 lines 60-61). 

Shipp in view of Devine do not show tokenizing the attachment. 

Milliken shows tokenizing the attachment to generate a token that is representative 
of the attachment, the tokenizing steps comprising the steps of generating a MD5 hash of 
the attachment ([0010-0013 and 0052]where MD5 hashes are inherently 128-bit). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine with that of Milliken in order to 
better identify spam email, as at the time of Shipp's disclosure, spam email was thought 
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"currently" not to be associated with attachments ([81]), an area for which Milliken's more 
recent disclosure provides updated guidance. 

Shipp in view of Devine and Milliken do not show appending the 32-bit string to the 
generated MD5 hash to produce a 160-bit number. 

Anderson shows ([0057-0059]) appending an MD5 hash (inherently 128-bits) to 
network transmission size information (shown by Devine to be said 32-bit string, and where 
32 +128 is inherently 160). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine and Milliken with that of 
Anderson in order to better uniquely identify messages (Anderson [0057-0059]), leading to 
improved message spam identification. 

Shipp in view of Devine, Milliken and Anderson do not show UUencoding said 160-bit 
number to generate a token representative of the attachment. 

Uuencode and MIME FAQ shows UUencoding a file. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine, Milliken and Anderson with 
that of Uuencode and MIME FAQ in order to store the message identification information 
(represented by the 160-bit number shown by Shipp in view of Devine, Milliken and 
Anderson) in a format easily exchanged over email (UUencode and MIME FAQ) since 
UUencoding produces an easily emailed file and since the disclosure of Shipp in view of 
Devine, Milliken and Anderson relates to email and files transferred over email. 
Furthermore, UUencoding is a prior art element, as shown in UUencode and MIME FAQ, and 
thus UUencoding the 160-bit number is combing a prior art element (UUencoding) to known 
methods (the known methods shown by Shipp in view of Devine, Milliken and Anderson) to 
yield predictable results (the results being a UUencoded item). 
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Shipp in view of Devine, Milliken, Anderson and UUencode and MIME FAQ do not 
show determining a probability value for each of the generated tokens. 

Gordon shows determining a probability value for each of the generated tokens (col. 
11 lines 15 -55). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine, Milliken, Anderson and 
Uuencode and MIME FAQ with that of Gordon in order to better identify spam elements in 
messages (Gordon col. 11 lines 15 -55). 

Shipp in view of Devine, Milliken, Anderson, UUencode and MIME FAQ and Gordon do 
not show selecting a predefined number of interesting tokens, the interesting tokens being 
the generated tokens having the greatest non-neutral probability value; performing a 
Bayesian analysis on the selected interesting tokens to generate a spam probability; and 
categorizing the email message as a function of the generated spam probability. 

Sahami shows selecting a predefined number of interesting tokens, the interesting 
tokens being the generated tokens having the greatest non-neutral probability value; 
performing a Bayesian analysis on the selected interesting tokens to generate a spam 
probability; and categorizing the email message as a function of the generated spam 
probability (pg. 2, col. 2; pg. 4, col. 2; pg. 6, col. 1). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine, Milliken, Anderson, Uuencode 
and MIME FAQ and Gordon with that of Sahami in order to more accurately identify spam 
email. 

Shipp in view of Devine, Milliken, Anderson, UUencode and MIME FAQ and Gordon 
and Sahami do not show explicitly show where the tokens are sorted in accordance with the 
corresponding determined spam probability value. 
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Woitaszek shows where the tokens are sorted in accordance with the corresponding 
determined spam probability value (Tables 4 and 5). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine, Milliken, Anderson, Uuencode 
and MIME FAQ, Gordon and Sahami with that of Woitaszek in order to arrange the 
calculated values in a logical manner, enabling a simple method of extracting the most 
interesting results (as discussed by Sahami) via simply taking the top occurring results in 
Woitaszek's sorted list, as well as to include the abilities to integrate the spam software into 
a commonly used email program (Woitaszek, Abstract, pg. 1 col. 2). 

Shipp in view of Devine, Milliken, Anderson, Uuencode and MIME FAQ, Gordon, 
Sahami and Woitaszek thus show claim 1. 

7. Regarding claim 39, Shipp in view of Devine, Milliken, Anderson, Uuencode and 
MIME FAQ, Gordon, Sahami, further in view of Woitaszek show wherein the email is 
received at a computing device (Milliken, Abstract, Shipp, Abstract). 

8. Claims 6, 16, 17, 23, 24, 25, 30, 31, 32, 33 and 34 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Shipp in view of Milliken and Woitaszek. 

9. Regarding claims 6 Shipp shows a method comprising receiving an email message 
comprising a text body ([0064,0065]), an SMTP email address ([0039.0043,0069]), and a 
domain name corresponding to the SMTP email address ([0039,0045,0046]); 

tokenizing the SMTP email address to generate a token representative of the SMTP 
email address ([0039,0043,0063]) 

tokenizing the domain name to generate a token representative of the domain name 
([0022]), and determining a spam probability value from the generated tokens 
([0014,0076]). 

Shipp does not show tokenizing the attachment to generate a token that is 
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representative of the attachment. 

Milliken shows tokenizing the attachment to generate a token that is representative 
of the attachment ([10-13 and 51 - 53]). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp with that of Milliken in order to better identify 
spam email, as at the time of Shipp's disclosure, spam email was thought "currently" not to 
be associated with attachments ([81]); spam and attachments are however an area for 
which Milliken's more recent disclosure provides updated guidance. 

Shipp in view of Milliken, Anderson do not show explicitly show where the tokens are 
sorted in accordance with the corresponding determined spam probability value. 

Woitaszek shows where the tokens are sorted in accordance with the corresponding 
determined spam probability value (Tables 4 and 5). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Devine, Milliken, Anderson, Uuencode 
and MIME FAQ, Gordon and Sahami with that of Woitaszek in order to arrange the 
calculated values in a logical manner, as well as to include the abilities to integrate the 
spam software into a commonly used email program (Woitaszek, Abstract, pg. 1 col. 2). 

Shipp in view of Milliken and Woitaszek thus show claim 6. 
9. Regarding claim 16, Shipp in view of Milliken and Woitaszek further show receiving 
an email message including a text body (Shipp [0064,0065]). 

7. Regarding claim 17, Shipp in view of Milliken and Woitaszek further show tokenizing 
the words in the text body to generate tokens representative of the words in the text body 
(Shipp [0064,0065]). 

8. Regarding claim 23, Shipp in view of Milliken and Woitaszek further show a system 
comprising a text body (Shipp, [0064,0065]), an SMTP email address (Shipp, 
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[0039.0043,0069]), and a domain name corresponding to the SMTP email address (Shipp, 
[0039,0045,0046]) and an attachment (Milliken [10-13]); 

tokenizing the SMTP email address to generate a token representative of the SMTP 
email address (Shipp, [0039,0043,0063]) 

tokenizing logic configured to tokenize the attachment to generate a token that is 
representative of the attachment (Milliken [10-13 and 51 - 53]) 

tokenizing the domain name to generate a token representative of the domain name 
(Shipp, [0022]), and 

determining a spam probability value from the generated tokens (Shipp, 
[0014,0076]) and 

sorting logic configured to sort the generated tokens in accordance with the 
corresponding determined spam probability value (Woitaszek, Abstract, Tables 4 and 5). 
9. Regarding claim 24, Shipp in view of Milliken and Woitaszek further show means for 
receiving an SMTP email address, and a domain name corresponding to the SMTP email 
address (Shipp, [0039,0045,0046]) and an attachment (Milliken [10-13]); 

means for tokenizing the SMTP email address to generate a token representative of 
the SMTP email address (Shipp, [0039,0043,0063]) 

means for tokenizing logic configured to tokenize the attachment to generate a token 
that is representative of the attachment (Milliken [10-13 and 51 - 53]) 

means for tokenizing the domain name to generate a token representative of the 
domain name (Shipp, [0022]), and 
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means for determining a spam probability value from the generated tokens (Shipp, 
[0014,0076]) and 

sorting logic configured to sort the generated tokens in accordance with the 
corresponding determined spam probability value (Woitaszek, Abstract, Tables 4 and 5). 

10. Regarding claim 25, Shipp in view of Milliken and Woitaszek further show a 
computer-readable medium comprising computer-readable code adapted to instruct a 
programmable device to receiving an email message comprising an SMTP email address, 
([0039.0043,0069]), a domain name corresponding to the SMTP email address 
([0039,0045,0046]) and an attachment (Milliken [10-13]); 

tokenizing the SMTP email address to generate a token representative of the SMTP 
email address ([0039,0043,0063]) 

tokenizing logic configured to tokenize the attachment to generate a token that is 
representative of the attachment (Milliken [10-13 and 51 - 53]) 

tokenizing the domain name to generate a token representative of the domain name 
([0022]), and 

determining a spam probability value from the generated tokens ([0014,0076]) and 
sorting logic configured to sort the generated tokens in accordance with the 
corresponding determined spam probability value (Woitaszek, Abstract, Tables 4 and 5). 

11. Regarding claim 30, Shipp in view of Milliken and Woitaszek further show a system 
comprising email logic configured to receive an email message comprising an attachment 
(Shipp [0018,0023] and Milliken [10-13])), 

tokenize logic configured to tokenize the entire attachment to generate a token 
representative of the attachment (Milliken [10-13 and 70]); and 

analysis logic configured to determine a spam probability values from the generated 
tokens (Milliken [10-13] and Shipp [14,76]) and 
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sorting logic configured to sort the generated tokens in accordance with the 
corresponding determined spam probability value (Woitaszek, Abstract, Tables 4 and 5). 

12. Regarding claim 31, Shipp in view of Milliken and Woitaszek further show means for 
receiving an email message comprising an attachment (Shipp [0018,0023] and Milliken [10- 
13])), 

means for tokenizing the attachment to generate a token representative of the 
attachment (Milliken [10-13 and 70]); and 

means for determining a spam probability values from the generated tokens (Milliken 
[10-13] and Shipp [14,76]) 

sorting logic configured to sort the generated tokens in accordance with the 
corresponding determined spam probability value (Woitaszek, Abstract, Tables 4 and 5). 

13. Regarding claim 32, Shipp in view of Milliken and Woitaszek further show a 
computer-readable medium comprising computer-readable code adapted to instruct a 
programmable device to receive an email message comprising an attachment (Shipp 
[0018,0023] and Milliken [10-13])), 

computer-readable code adapted to instruct a programmable device to tokenize logic 
configured to tokenize the entire attachment to generate a toke representative of the 
attachment (Milliken [10-13 and 70]); and 

computer-readable code adapted to instruct a programmable device to determine a 
spam probability values from the generated tokens (Milliken [10-13] and Shipp [14,76]) 
and 

computer-readable code adapted to instruct a programmable device to sort the 
generated tokens in accordance with the corresponding determined spam probability value 
(Woitaszek, Abstract, Tables 4 and 5). 
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14. Regarding claim 33, Shipp in view of Milliken and Woitaszek further show receiving 
an email message including a text body (Shipp [0064,0065]). 

15. Regarding claim 34, Shipp in view of Milliken and Woitaszek further show tokenizing 
the words in the text body to generate tokens representative of the words in the text body 
(Shipp [0064,0065]). 

16. Claims 11, 12, 13,14, 19, 20, 21, 22, 26, 27, 28, 29, 35, 36, 37, and 38 are 
rejected under 35 U.S.C. 103(a) as being unpatentable over Shipp in view of Milliken and 
Woitaszek as applied to claims 6 and 25 above, and further in view of Sahami. 

10. Regarding claims 11 and 26, Shipp in view of Milliken and Woitaszek show assigning 
a spam probability value to the token representative of the SMTP email address (Shipp 
[0018,0023,0039,0040-0043], Woitaszek, Tables 4 and 5) and 

assigning a spam probability value to the token representative of the domain name 
(Shipp [0022]). 

Shipp in view of Milliken and Woitaszek do not show explicitly show generating a 
Bayesian probability values using the spam probability values assigned to the tokens. 

Sahami shows generating a Bayesian probability values using the spam probability 
values assigned to the tokens (pg.2, col. 2; pg. 4, col. 2; pg. 6, col. 1). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Milliken, Woitaszek and Gordon with 
that of Sahami in order to more accurately identify spam email. 

11. Regarding claims 12 and 27 Shipp in view of Milliken, Woitaszek and Sahami further 
show comparing the generated Bayesian probability value with a predefined threshold value 
(Sahami, pg.2, col. 2; pg. 4, col. 2; pg. 6, col. 1). 

12. Regarding claims 13 and 28 Shipp in view of Milliken, Woitaszek and Sahami further 
show categorizing the email message as spam in response to the Bayesian probability value 
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being greater than the predefined threshold (Sahami, pg.2, col. 2; pg. 4, col. 2; pg. 6, col. 
1). 

13. Regarding claims 14 and 29 Shipp in view of Milliken and Sahami further show 
categorizing the email message as non-spam in response to the Bayesian probability value 
being not greater than the predefined threshold (Sahami pg. 6 col. 1). 

14. Regarding claims 19 and 35, Shipp in view of Milliken and Woitaszek show claim 17 
and 34, as well as assigning a spam probability value to each of the tokens representation 
of the words in the text body (Woitaszek, Tables 4 and 5) 

assigning a spam probability value to token representative of the attachment 
(Woitaszek, Tables 4 and 5, and Milliken, [10-13]), but rather determining a single spam 
probability value utilizing the tokens. 

Shipp in view of Milliken and Woitaszek do not explicitly show generating a Bayesian 
probability value using the spam probability values assigned to the token. 

Sahami shows generating a Bayesian probability value using the spam probability 
values assigned to the token (Sahami, pg. 4 col. 2). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Shipp in view of Milliken and Woitaszek with that of 
Sahami in order to more accurately identify spam email. 

15. Regarding claims 20 and 36, Shipp in view of Milliken and Sahami further show 
comparing the generated Bayesian probability value with a predefined threshold value 
(Sahami, pg. 4 col. 2). 

16. Regarding claims 21 and 37, Shipp in view of Milliken, Woitaszek and Sahami further 
show categorizing the email message as spam in response to the Bayesian probability value 
being greater than the predefined threshold (Sahami, pg.2, col. 2; pg. 4, col. 2; pg. 6, col. 
1)- 



Application/Control Number: 10/685,656 Page 16 

Art Unit: 2142 

17. Regarding claims 22 and 38, Shipp in view of Milliken, Woitaszek and Sahami further 
show categorizing the email message as non-spam in response to the Bayesian probability 
value being not greater than the predefined threshold (Sahami, pg. 6 col. 1). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M. Macllwinen whose telephone number is (571) 272- 
9686. The examiner can normally be reached on M-F 7:30AM - 5:00PM EST; off alternate 
Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571) 272-3868. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status information 
for unpublished applications is available through Private PAIR only. For more information 
about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866- 
217-9197 (toll-free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786-9199 (IN USA 
OR CANADA) or 571-272-1000. 

/Andrew Caldwell/ 

Supervisory Patent Examiner, Art 

Unit 2142 

John Macllwinen 
(571) 272 - 9686 
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